How Does Deepfake Detection Fit Into Customer Onboarding?

Where does deepfake detection sit in a customer onboarding flow?

Deepfake detection sits at the biometric capture step of onboarding, between the moment the customer takes a selfie or records a short video and the moment your system decides whether to open the account. It analyses the captured media and hands a score to the decision engine, alongside document verification and face match results.

Synchronous placement works best for selfies. If the check runs as soon as the image is uploaded, a borderline result can prompt the customer to retake the photo in better light while they are still on the screen, instead of sending them to a review queue and an email follow-up a day later. Video and voice samples take longer to process and can be scored in parallel with the document check, with the decision waiting for both.

Onboarding does not end at account opening. The same face evidence comes back at account recovery, device changes, limit increases and periodic re-KYC, and attackers who fail at the front door often try those side doors. Run the same check there.

How to add deepfake checks without slowing genuine customers

Keep the check passive. NIST SP 800-63A-4, published in July 2025, recommends that identity proofing providers introduce a passive means of detecting forged or manipulated media for all capture scenarios. A passive check analyses the image or video the customer already submitted, so it adds no prompts, gestures or extra screens.

Set a latency budget for the step and test it on real devices and networks. An image check that returns in a fraction of a second is invisible next to upload time on a mobile connection. Long video processing should run while the customer is completing other steps, not while they stare at a spinner.

Most genuine customers who score in the borderline band do so because of poor capture: low light, motion blur, heavy compression or an old front camera. Give them one guided recapture before escalating. Escalate on the second borderline result, or immediately on a high one.

Design fallback routes with care. FinCEN's November 2024 deepfake alert notes that someone opening an account with an AI-generated identity document may claim repeated technical glitches or ask to change communication methods during a live check. If your fallback is an emailed photo or a call with lighter checks, it becomes the bypass. Apply the same media analysis to every channel that accepts face or voice evidence.

What manual reviewers need from a deepfake check

Manual review stays in the process. NIST SP 800-63A-4 says algorithmic analysis of media and automated decisioning should be augmented by manual review to address detection errors. The detector narrows the queue to the cases worth a human look; it does not remove the human.

Reviewers need more than a number. Give them the signal-level breakdown (for example, whether the flag came from face manipulation, generative-model traces or pixel-level edits), the original media, the document image, device and session data, and any earlier attempts linked to the same face, device or network. A score of 0.8 with no context leads to inconsistent decisions between reviewers.

Size the queue with the threshold. Every point you move the review threshold changes how many cases land with your team each day, so model expected volumes on a sample of your own traffic before go-live, and agree a service level for how fast a flagged applicant gets an answer. Label every reviewed case as genuine or attack, and feed those labels back into threshold tuning.

How privacy rules apply to deepfake checks in onboarding

Treat the deepfake check as a fraud control that processes personal data, and assess it before launch. NIST SP 800-63A-4 requires identity proofing providers to conduct a privacy risk assessment of all fraud checks and fraud mitigation technologies prior to implementation.

In the UK, the Information Commissioner's Office says that when you use a biometric recognition system you must identify a lawful basis and a separate condition for processing special category biometric data. It adds that explicit consent is likely to be the most appropriate condition in many cases, and that when you rely on consent you must offer a suitable alternative to people who decline. Whether an authenticity check on its own counts as biometric recognition depends on how it is built and used; the guide to GDPR and biometric authenticity analysis covers that question.

Data minimisation is the practical lever. Decide how long submitted media and results are kept, who can see them, and where they are processed. Neural Defend offers managed cloud, private cloud or VPC, secure container, on-premises and air-gapped deployment, and documents its approach in its product data handling notes.

What a deepfake check in onboarding will not catch

A deepfake check judges the media, not the route it took. The World Economic Forum's January 2026 report on deepfakes and digital identity describes attackers combining stolen or AI-generated identity documents, face-swapped media and camera injection tools that feed synthetic video into live biometric checks. Media analysis covers the face-swap part. Device attestation, virtual camera checks and session binding cover the injection part, and document verification covers the ID.

It also will not flag an unedited, genuine recording of the real customer replayed into the flow, because there is nothing manipulated to find. Freshness checks and duplicate-media search handle that. And no threshold removes all errors: a stricter setting catches more attacks and sends more genuine customers to review, which is a trade-off your risk and product teams should set together.

How NeuroVerify plugs into an onboarding flow

NeuroVerify accepts the three media types onboarding flows collect: face images, video and audio. One API call runs six signals (Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance) and returns one unified risk score with signal-level evidence that a reviewer can read.

Eligible image requests return in under 200 ms p95 under defined test conditions, which keeps the selfie step synchronous. Mobile SDKs for Android, iOS and Flutter sit next to your capture screen, and backend SDKs for Python, TypeScript, Go and Java or the REST API let your server call it after upload. Neural Defend describes setup as two lines to integrate and live in under 24 hours; the digital onboarding solution page shows the full flow.

The detection models build on ARCAS 1B, Neural Defend's foundation model for deepfake detection. On the public VendorBench-100 still-image benchmark, Neural Defend ranked first of 36 systems with an MCC of 0.876; one of the benchmark's authors also co-authored the ARCAS paper, and the corpus is public. Neural Defend holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certifications. NeuroVerify does not analyse ID documents, so it runs beside your document verification step.